thelabdude opened a new pull request #346:
URL: https://github.com/apache/solr-operator/pull/346
Fixes #331
Just a quick prototype to flush out the config so far ... manually tested
with Keycloak.
Example SolrCloud CRD YAML:
```
spec:
...
solrSecurity:
authenticationType: Oidc
probesRequireAuth: false
bootstrapSecurityJson:
name: security-jwt-keycloak
key: security.json
oidc:
clientCredentialsSecret: keycloak-gatekeeper
wellKnownUrl: http://192.168.86.21:8080/auth/realms/local
```
security.json for Keycloak:
```
{
"authentication": {
"blockUnknown": false,
"class": "solr.JWTAuthPlugin",
"wellKnownUrl":
"http://192.168.86.21:8080/auth/realms/local/.well-known/openid-configuration";,
"clientId": "gatekeeper",
"redirectUris": "http://localhost:8983/solr/";,
"rolesClaim": "groups"
},
"authorization": {
"class": "solr.ExternalRoleRuleBasedAuthorizationPlugin",
"permissions": [ ... ]
}
}
```
Todo:
- [ ] Unit tests
- [ ] Manual test with another OIDC provider such as Okta
- [ ] Manual test to verify the cached OAuth2 TokenSource can refresh the
JWT when it expires
- [ ] Remove use of `loghttp.Transport` from `api.go` (used for debugging
requests to Solr)
- [ ] Enhance documentation
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
